El Miércoles, 11 de Octubre de 2006 04:07, hanpingtian@gmail.com escribió:
Today I find that some strange things happened on rkhunter, some files belong to it missing: $ rpm -V rkhunter ..?..... /etc/cron.daily/01-rkhunter ..?..... /etc/rkhunter.conf ..?..... /etc/sysconfig/rkhunter ..?..... /usr/bin/rkhunter missing /usr/lib/rkhunter/scripts/check_modules.pl missing /usr/lib/rkhunter/scripts/check_port.pl missing /usr/lib/rkhunter/scripts/check_update.sh missing /usr/lib/rkhunter/scripts/filehashmd5.pl missing /usr/lib/rkhunter/scripts/filehashsha1.pl missing /usr/lib/rkhunter/scripts/showfiles.pl missing /var/rkhunter/db/backdoorports.dat missing /var/rkhunter/db/defaulthashes.dat missing /var/rkhunter/db/md5blacklist.dat missing /var/rkhunter/db/mirrors.dat missing /var/rkhunter/db/os.dat missing /var/rkhunter/db/programs_bad.dat missing /var/rkhunter/db/programs_good.dat Is this a updating problem of rkhunter itself? Or some rootkits kill it?
I've never install rkhunter from a RPM, I always use it from a tarball. By the way, I've not found out that problems in normal situation. So, maybe you should check your logs in order to see if someone broke into your box.
When I use rkhunter or other rootkit-detector I'm used to install it on a no default path, maybe this way rootkits won't be able to delete any file either trojanized one.
Greetings.